Malicious RTF / .DOC — malware analysis report

Static analysis result for SHA-256 d5c884486ee2f82f…

MALICIOUS

RTF / .DOC

4.7 KB
MD5: 4ab890c1636cc4806d2c75ccc54c041f SHA-1: 80ef6f3868664014237245500e069592cacc0a60 SHA-256: d5c884486ee2f82f49b424ee7a066c9e8a22454c53332ac5c03b61ec4a4297e2
120 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1204.002 Malicious File T1059.003 Windows Command Shell

The file is an RTF document containing embedded OLE object data, specifically triggering the Equation Editor vulnerability. The \objupdate directive indicates that the embedded object will be automatically activated upon opening, leading to code execution. This is a common delivery mechanism for exploiting the Equation Editor vulnerability.

Heuristics 3

  • Split hex Equation Editor ProgID + OLE object critical RTF_EQUATION_EDITOR
    RTF embeds the Equation.3 ProgID as hex bytes near OLE object activation and splits the byte stream with whitespace or an ignorable RTF group. This is an Equation Editor OLE activation surface commonly used by CVE-2017-11882 / CVE-2018-0802 exploit documents.
  • \objupdate forces OLE activation high RTF_OBJUPDATE
    RTF contains \objupdate — forces automatic OLE object instantiation when the document is opened, bypassing user interaction. Almost exclusively seen in Equation Editor exploit documents.
  • OLE object data medium RTF_OBJDATA
    RTF contains 2 \objdata section(s) — embedded OLE objects

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
objdata_00_off000000b6.bin
f11d1f3abfc0c29446a64e2dd5bce3c0a25c75b08a3f25175b2bbf9391bfa821		 rtf-objdata-decoded RTF \objdata at offset 0xB6 2101 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.